Verify that FIPS is Enabled

  1. Check the OpenSSL FIPS providers.

    root@<device name>:~# openssl list -providers

    Providers:

    default

      name: OpenSSL Default Provider

      version: 3.0.10

      status: active

     fips

      name: OpenSSL FIPS Provider

      version: 3.0.8

      status: active

  2. Check that the digest algorithms provided by OpenSSL is limited to FIPS compliant ciphers/algorithms.

    root@<device name>:~# openssl list -digest-algorithms
    ...
    Provided:
      { 2.16.840.1.101.3.4.2.1, SHA-256, SHA2-256, SHA256 } @ default
      { 2.16.840.1.101.3.4.2.10, SHA3-512 } @ default
      { 2.16.840.1.101.3.4.2.8, SHA3-256 } @ default
      { 2.16.840.1.101.3.4.2.7, SHA3-224 } @ default
      { 2.16.840.1.101.3.4.2.2, SHA-384, SHA2-384, SHA384 } @ default
      { 2.16.840.1.101.3.4.2.3, SHA-512, SHA2-512, SHA512 } @ default
      { 2.16.840.1.101.3.4.2.5, SHA-512/224, SHA2-512/224, SHA512-224 } @ default
      { 2.16.840.1.101.3.4.2.12, SHAKE-256, SHAKE256 } @ default
      { 1.3.14.3.2.26, SHA-1, SHA1, SSL3-SHA1 } @ default
      { 2.16.840.1.101.3.4.2.9, SHA3-384 } @ default
      { 2.16.840.1.101.3.4.2.11, SHAKE-128, SHAKE128 } @ default
      { 2.16.840.1.101.3.4.2.4, SHA-224, SHA2-224, SHA224 } @ default
      { 2.16.840.1.101.3.4.2.6, SHA-512/256, SHA2-512/256, SHA512-256 } @ default
      { KECCAK-KMAC-128, KECCAK-KMAC128 } @ default
      { KECCAK-KMAC-256, KECCAK-KMAC256 } @ default
      { 2.16.840.1.101.3.4.2.1, SHA-256, SHA2-256, SHA256 } @ fips
      { 2.16.840.1.101.3.4.2.10, SHA3-512 } @ fips
      { 2.16.840.1.101.3.4.2.8, SHA3-256 } @ fips
      { 2.16.840.1.101.3.4.2.7, SHA3-224 } @ fips